Rich - I have TDS-3 set to show all NTFS ADS that it finds, so it's not a case of "what was in there that may have triggered the alarm" - it's just the way I have it set up to scan. No, I didn't examine the first stream or the subsequent ones.

Anyway, got an email response from DCS's support on the prior beta's Unhackme.exe that I submitted: